1. Instantiation of the Concept in GAMMA Prototypes
Claudio Porretti
GAMMA Final Event - Rome, 15 November 2017

2. The mapping of prototypes onto the GAMMA concept
ATM Nodes
Local Security
Systems
Systems
Information
Exchange
Gateway
Coordination
& Control
Information
Security System
LGSOC
Satcom Security
Cyber Security
intelligence
Secure
GNSS
communications
LGSOC
Secure ATC
communications
NGSMP
EGCC
ATM Security
Management Platform
(SMP)
Attack
Prediction
Integrated
Modular
Communication
LGSOC
Local
National
European
The GAMMA concept is built on distributed nodes embedded within the ATM system capable of providing interfaces towards security systems.
The GAMMA vision recognises the opportunities opened by a collaborative framework for managing security, building a solution based on the self-protection and resilience of the ATM system
© GAMMA.All rights reserved

3. GAMMA Security Prototypes
Information
Exchange
Gateway
IEG will serve to protect ATM web services (SWIM) from XML-based threats. The information exchange gateway is capable of detecting new kinds of offensive contents and intercepts them by deciphering, analyzing and confronting the messages with the access and filtering policy.
Information
Security System
The Information Security System (ISS) is a solution to protected data communication in the Airport side and PENS network for ATN communication system that are using new datalink communication system (AeroMACS and VoIP ATN communication service)
Satcom Security
The SATCOM Security prototype is a client /server solution designed to secure the management and control of the satellite networks used in ATM.
© GAMMA.All rights reserved
Secure
GNSS
communications
The GNSS Monitoring System (GMS) can detect GNSS spoofing and jamming
Secure ATC
communications
The Secure ATC Communication prototype increases the security in voice communication between pilots and ATCOs
Integrated
Modular
Communication
The Integrated Modular Communication (IMC) provides secure and reliable off-board aircraft communications for a diverse set of on-board applications.

4. The role of the SMP within the GAMMA concept
Satcom Security
Secure
GNSS
communications
Secure ATC
Information
Exchange
Gateway
Security
System
Integrated
Modular
Communication
ATM Security
Management Platform
Information Dissemination System
Attack
Prediction
Cybersecurity
Intelligent
Platform
Coordination
and Control
© GAMMA.All rights reserved

5. The role of the SMP within the GAMMA concept
SMP is the “core” of the GAMMA concept, and will provide a basis for the management of security throughout the phases, from prevention to the identification of security incidents and the efficient resolution of the resulting ATM crises.
The SMP is intended to provide Situational Awareness (applying cross-correlation techniques of events) and Decision Support functionalities supporting the coordinated management of ATM security.
ATM Security
Management Platform
Information Dissemination System
Attack
Prediction
Cybersecurity
Intelligent
Platform
Coordination
and Control
System
For this purpose the shared platform includes specific capabilities such as Cyber Security Intelligence and Attack Effect Prediction, in order to provide decision support to GAMMA operators.
Moreover, the SMP includes an Information Dissemination System that allows the dissemination of security information through the multilevel architecture proposed by the GAMMA solution.

6. © GAMMA.All rights reserved
Security Management Platform: main functions (1/2)
Coordination & Control System:
Provides security events correlation for the identification of Alarms, Security Monitoring and Decision Support for Incident/Crisis Management
A decision support function allows the operator to provide possible countermeasures to Local Security Systems or other SMPs.
A sanitization function is also available in order to opportunely modify sensitive information before transferring them to the IDS module for dissemination.
Cyber Security Intelligence Platform:
provides GAMMA operators the possibility to obtain relevant information about possible (cyber) attacks on ATM systems, crawling the internet though open sources such as social networks, in order to determine the sentiment and/or threats related to a particular target.
It allows also to identify the motivation, the characteristics and the identities of the attackers.
© GAMMA.All rights reserved

7. © GAMMA.All rights reserved
Security Management Platform: main functions (2/2)
Attack Effect Prediction:
Is a decision support SMP sub-system that provides a joint assessment of the information received from different sensors (event detectors)
It creates a directed graph structure to describe the ATM system encoding all Supporting Assets (SA) as a subset of nodes and all threat scenarios as a set of paths to the SAs, that form the graph
Additionally, an impact value for each type of attack for each security control is given (or a set of values for different Impact Areas).
Information Dissemination System:
Disseminate automatically security reports from the SMP at European level to connected SMPs at National levels, applying (automatic) filtering conditions
Allow the SMP operator at National level to disseminate manually security reports to other connected Security Management Platforms at national or European level
Show security reports on both tabular and geographical presentations and security critical subjects (e.g. aircraft, network trunk/nodes, critical infrastructures) on the concise situational awareness display allowing for early detection of potential causality/escalation.
© GAMMA.All rights reserved

8. Security Management Platform architectural lay out
Alerts in input to SMP
Coordination and Control Module
<ATM Alarms>
Data Collectors
<Local ATM domain>
<Alarms>
<Local Security Operation Centre>
Visualization Module
Information
Exchange
Gateway
Correlation Engine
Rule Engine
Event Bus
Information
Security System
Satcom Security
SECURITY PROTOTIPES:
Secure GNSS
communications
<Countermeasures>
Decision Support
Secure ATC
communications
© GAMMA.All rights reserved
Integrated
Modular
Communication
IDS
Module
Attack Prediction
Module
Cyber Security
Intelligence Platform

9. The SMP in the multilayer approach of GAMMA concept
European GAMMA Control Center (EGCC)
ATM Security Management Platform
Coordination and Control module
Cyber Security
Intelligence Platform
Attack
Prediction
Event Bus
IDS
EUROPEAN LEVEL
NATIONAL
LEVEL
<Cooperation>
<Cooperation>
<Cooperation>
National GAMMA
Security Management Platform
IDS
Attack
Prediction
Event Bus
Command and Control
Module
Security
Intelligence
National GAMMA
Security Management Platform
IDS
Attack
Prediction
Event Bus
Command and Control
Module
Security
Intelligence
National GAMMA
Security Management Platform
IDS
Attack
Prediction
Event Bus
Command and Control
Module
Security
Intelligence
NATION 1
NATION 2
NATION 3
The European and National levels of the GAMMA concept are implemented through the deployment of the SMP:
One SMP instance at European Level in the European GAMMA Coordination Centre
One SMP instance for each Nation
© GAMMA.All rights reserved